CVE-2021-42740

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec, an...

Command injection

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec, an...

CVE-2021-42740

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec, an...

CVE-2021-42740

CVE-2021-42740 affects the shell-quote package for Node.js (pre-1.7.3). The Windows drive-letter regex was {A-z] instead of {A-Za-z], enabling injection of shell metacharacters when unescaped output is passed to a real shell via exec(). Attacks can lead to arbitrary commands execution under the d...

CVE-2021-42740

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec, an...

CVE-2021-42740

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec, an...

CVE-2021-42740

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec, an...

[ASA-202110-4] nodejs: url request injection

Arch Linux Security Advisory ASA-202110-4 ========================================= Severity: Medium Date : 2021-10-21 CVE-ID : CVE-2021-22959 CVE-2021-22960 Package : nodejs Type : url request injection Remote : Yes Link : https://security.archlinux.org/AVG-2460 Summary ======= The package nodej...

[ASA-202110-5] nodejs-lts-fermium: multiple issues

Arch Linux Security Advisory ASA-202110-5 ========================================= Severity: High Date : 2021-10-21 CVE-ID : CVE-2021-22939 CVE-2021-22940 CVE-2021-22959 CVE-2021-22960 Package : nodejs-lts-fermium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2284...

CVE-2021-42740: Improper Neutralization of Special Elements used in a Command

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec, an...

[ASA-202110-6] nodejs-lts-erbium: multiple issues

Arch Linux Security Advisory ASA-202110-6 ========================================= Severity: High Date : 2021-10-21 CVE-ID : CVE-2021-22939 CVE-2021-22940 CVE-2021-22959 CVE-2021-22960 Package : nodejs-lts-erbium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2285...

Security Bulletin: IBM App Connect Enterprise Certified Container Integration Servers may be vulnerable to code injection due to CVE-2021-23406

Summary IBM App Connect Enterprise Certified Container Integration Servers may be vulnerable to code injection due to CVE-2021-23406 Vulnerability Details CVEID: CVE-2021-23406 DESCRIPTION: Node.js pac-resolver module could allow a remote attacker to execute arbitrary code on the system, caused b...

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to regular expression denial of service due to a vulnerability in the Node.js validator module

Summary IBM App Connect Enterprise Certified Container may be vulnerable to a regular expression denial of service attack when parsing an Open API/Swagger document, due to a vulnerability in the Node.js validator module Vulnerability Details Third Party Entry: 207314 DESCRIPTION: Node.js validato...

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to directory traversal due to CVE-2021-32804

Summary IBM App Connect Enterprise Certified Container may be vulnerable to directory traversal due to CVE-2021-32804. This only affects Node.js runtime processes. Vulnerability Details CVEID: CVE-2021-32804 DESCRIPTION: Node.js tar module could allow a local attacker to traverse directories on t...

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to directory traversal due to CVE-2021-32803

Summary IBM App Connect Enterprise Certified Container may be vulnerable to directory traversal due to CVE-2021-32803. This only affects Node.js runtime processes. Vulnerability Details CVEID: CVE-2021-32803 DESCRIPTION: Node.js tar module could allow a local attacker to traverse directories on t...

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to memory corruption due to CVE-2021-22940

Summary IBM App Connect Enterprise Certified Container may be vulnerable to memory corruption due to CVE-2021-22940. This only affects Node.js runtime processes. Vulnerability Details CVEID: CVE-2021-22940 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused ...

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to memory corruption due to CVE-2021-22930

Summary IBM App Connect Enterprise Certified Container may be vulnerable to memory corruption due to CVE-2021-22930. This only affects Node.js runtime processes. Vulnerability Details CVEID: CVE-2021-22930 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused ...

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to denial of service due to CVE-2021-22918

Summary IBM App Connect Enterprise Certified Container may be vulnerable to denial of service due to CVE-2021-22918. This only affects Node.js runtime processes. Vulnerability Details CVEID: CVE-2021-22918 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by an out-of-bounds read ...

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to domain hijacking due to CVE-2021-22931

Summary IBM App Connect Enterprise Certified Container may be vulnerable to domain hijacking due to CVE-2021-22931. This only affects Node.js runtime processes. Vulnerability Details CVEID: CVE-2021-22931 DESCRIPTION: Node.js could provide weaker than expected security, caused by missing input...

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to trusting expired certificates due to CVE-2021-22939

Summary IBM App Connect Enterprise Certified Container may be vulnerable to trusting expired certificates due to CVE-2021-22939. This only affects Node.js runtime processes. Vulnerability Details CVEID: CVE-2021-22939 DESCRIPTION: Node.js could allow a remote attacker to bypass security...